Privacy Policy

This Privacy Policy explains how AYUSHI HEALTHSYNC TECHNOLOGIES LLP, operating as Ayushi HealthSync (“Ayushi HealthSync”, “we”, “us”, or “our”), handles digital personal data through this website, MedChaaya, and related services that link to this policy.

Depending on the service, we may act as a Data Fiduciary determining why and how personal data is processed, or as a Data Processor acting on documented instructions from a hospital, clinician, diagnostic provider, or other customer. The relevant customer agreement may provide additional details.

Depending on your interaction with us, this may include:

• identity and contact details, such as name, email address, telephone number, and organization;
• account, authentication, professional, facility, and role information;
• appointment, consultation, prescription, diagnostic, medical-document, and health-record information;
• communications, support requests, demo enquiries, and feedback;
• device, browser, IP address, log, security, and service-usage information; and
• consent, authorization, audit, and transaction records required to operate healthcare workflows.

The precise data collected depends on the product, customer configuration, and care workflow. We seek to collect only data reasonably necessary for the stated purpose.

We may process personal data to provide and secure our services, create and administer accounts, facilitate authorized healthcare workflows, respond to enquiries, provide customer support, prevent misuse, maintain audit records, improve reliability, comply with law, and establish or defend legal claims.

Where consent is the applicable basis, we request consent through a clear notice and provide a method to withdraw it. Withdrawal does not affect processing already lawfully completed and may limit features that require the relevant data.

Health information is treated as confidential and subject to enhanced access and security controls. Where an authorized deployment uses ABDM or ABHA-related services, data exchange will be governed by applicable National Health Authority requirements, the Health Data Management Policy, patient authorization, and the participating organization’s responsibilities.

We do not claim that every product or deployment is integrated with, certified by, or approved under ABDM. The status and scope of any integration will be disclosed for the relevant service.

We may share personal data only as reasonably necessary with:

• the healthcare organization or professional responsible for the relevant service;
• authorized recipients selected by the individual or customer;
• cloud, contact-form delivery, communications, security, analytics, and support vendors bound by appropriate obligations;
• professional advisers, auditors, insurers, and transaction counterparties subject to confidentiality; and
• government bodies, regulators, courts, or law-enforcement authorities where legally required.

We do not sell personal health information.

This website may use essential storage required for security, preferences, and core functionality. If optional analytics or marketing technologies are introduced, we will provide appropriate notice and choices where required. You can also control cookies through your browser settings.

We retain personal data only for as long as reasonably necessary for the stated purpose, contractual obligations, healthcare record requirements, security, dispute resolution, and applicable law. When retention is no longer required, data is deleted, anonymized, or securely isolated in accordance with applicable procedures and customer instructions.

We use proportionate technical and organizational safeguards that may include encryption in transit, access controls, authentication, audit logging, backups, vulnerability management, monitoring, and incident-response procedures. No digital service can promise absolute security, and users must also protect their credentials and devices.

Where the Digital Personal Data Protection Act, 2023 or other applicable law requires verifiable consent from a parent or lawful guardian, we or the responsible healthcare organization will obtain it before the relevant processing, subject to applicable exemptions. Our general website is not directed to children for independent commercial use.

Subject to applicable law and verification, you may request information about your personal data, correction or updating, erasure where appropriate, withdrawal of consent, and grievance redressal. You may also nominate another individual to exercise applicable rights in the event of death or incapacity.

If data is controlled by a hospital or another customer, we may direct the request to that organization or assist it in responding. We may retain limited information where law or a valid legal purpose requires it.

Service providers may process data from locations permitted under applicable Indian law and contractual requirements. For healthcare deployments, hosting location and transfer controls may also be defined by the customer agreement, sector requirements, and applicable government restrictions.

To exercise a privacy right, report a concern, or ask a question, email info@medchaaya.in. Please describe the service involved and the request. We may ask for information needed to verify identity and protect confidentiality.

Registered office: Hall No 2, FF, Above Central Bank, GTB Complex, C.T.T. Nagar, Huzur, Bhopal, Madhya Pradesh 462003, India. Telephone: +91 95894 74572.

We may update this policy as our products, processing activities, or legal requirements change. The revised version will be posted here with a new effective date, and material changes will be communicated through an appropriate channel where required.